Analysis

  • max time kernel
    1s
  • max time network
    8s
  • platform
    android-9_x86
  • resource
    android-x86-arm-20240910-en
  • resource tags

    arch:armarch:x86image:android-x86-arm-20240910-enlocale:en-usos:android-9-x86system
  • submitted
    25/03/2025, 08:18

General

  • Target

    Magisk-28.1(28100).apk

  • Size

    11.2MB

  • MD5

    ebe29762bb3ba4397462812ecf28ba0c

  • SHA1

    c1611cf8276883622f5c2ede709113ffc7ec8227

  • SHA256

    8bfd3346b3da5814f82eff6f1b1b5fedd0ad585f39a25709b23eb54aac45691d

  • SHA512

    82ef2227f34315a60bdcbe1be10df6b5c2c76ff10b778760a2a53c1299cb2cb75c94f5c239ecfa9d0da3eabb738937db117a4ae55b1c7f74f93af236a1d83cd3

  • SSDEEP

    196608:0GaYVcVS4OlQ4OB2oTn9ko7scmdA5ASw7liDOLANeHqghsH5Wt5Red+La06NSnzG:0GbwUzbokAscmgq66ANGqCMdLzAS

Score
4/10

Malware Config

Signatures

  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

Processes

  • com.topjohnwu.magisk
    1⤵
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    PID:4318
    • su --mount-master
      2⤵
        PID:4348

    Network

    MITRE ATT&CK Mobile v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • /data/data/com.topjohnwu.magisk/files/profileInstalled

      Filesize

      24B

      MD5

      6f5a1fabe434d4ae74223f2529925fbc

      SHA1

      c9c2f68b92b5a1744ee1291e3f15a654b0f82216

      SHA256

      2ddfeeeaf469cf392339d8a0e2fd6a7418aaba96e5260b7d652707abd6970715

      SHA512

      be0f41ad8ab94869abfd2b74bc0e28e7108cf21c1fbb9a9295f046a8f5efbd69aa3296a273f458ece32957e49dbe1044777195f85a205a4fe67833e0574728e2

    • /data/data/com.topjohnwu.magisk/files/profileinstaller_profileWrittenFor_lastUpdateTime.dat

      Filesize

      8B

      MD5

      0a586d64a1eb5edf1856574633bdf450

      SHA1

      d1c05c1be0c47e402a586e0e28696dacfbee6e49

      SHA256

      3d8059a308d141c5d074e836fce7aaecc8e1ee1d757792d490915f89bce46e63

      SHA512

      30e82101cec8928cdb861ff3410c098686e4e89be02aa4bace3d076cd41cd671721530e52d562edeed1a36f1db25ba30f32cce982e694f9d4351b38238b19767

    • /data/misc/profiles/cur/0/com.topjohnwu.magisk/primary.prof

      Filesize

      3KB

      MD5

      12ade2275cbe887e0559d74347973235

      SHA1

      3bd792627b62ef615a7d339d684aa0d330714c10

      SHA256

      66e211c4a355c5f973622410f98d5b597c0271ada16ff9da20d7ee7ad30b09be

      SHA512

      a9feaaa0f8e51be69d538d6efd9ef16174313f61086d35eccdbf830965c833a5bf2e65a986ff57dbf76f9b04166a54a17dcf58607b258084427c3a54c6da741c